RFC2385 (MD5 signature in TCP packets) support

[David Schwartz]

	Has anyone made a patch or done any work on RFC2385 support for Linux? I'm 
willing to code the subset of it that I need if there's a general consensus 
that my approach is reasonable.

	I don't plan to add a table of IPs/ports and have the kernel automatically 
invoke authentication for those IPs/ports. This is mostly because I don't 
need this functionality, but if it's felt that this is the only way to go, 
then I'll reconsider my plans.

	I plan to add a socket option. You use it after you bind for inbound TCP 
connections and before you connect for outbound. You simply set the key to be 
used on the connection in the sockopt call. There would also be an option to 
allow/disallow unkeyed connections (should the key be optional or mandatory). 
Also, a get socket option would allow you to determine whether the key was 
being used or not.

	One limitation of this approach is that for inbound connections, you can't 
have a different password for multiple hosts that might connect to you.

	My interest for this is mostly for Zebra to be able to make secure BGP 
connections, so I would also contribute a patch for Zebra to support this 
feature on Linux.

	Am I wasting my time? Is there interest?

-- 
David Schwartz
<[e-mail]>